Sophos SG Series UTM announced as Winner of Best UTM Solution in 2015 SC Awards

2015/06/11 by admin

Sophos SG Series UTM solution fought off competition from Fortinet, Check Point and Barracuda at the SC Magazine Awards 2015

OXFORD, UK – 10th June, 2015 – Sophos is pleased to announce that its Sophos SG Series UTM appliances were recognised by a panel representing the audience of SC Magazine, as the winning solution in the Best UTM Solution category at the 2015 SC Magazine Awards Europe 2015. The announcement was made Tuesday, 2nd June, 2015 at the awards presentation held at The Ballroom,Grosvenor House on Park Lane, London.

“We are delighted that our SG Series UTM came out on top at the SC Magazine Awards. Winning this award is a real honor and just shows that the features and models we have been adding to our SG series, such as the new integrated wireless models, are making Sophos a real leader in the UTM Firewall market” said Chris Weeds, Director, Product Marketing, Sophos. “Our network security product team are rightly proud of this achievement, but credit also goes to our partners and customers, whose input and feedback helps us to continue to build great products.“

Sophos’ SG Series UTM was also recently awarded five stars by PC Pro Magazine, and added to their A-List.

Each year, hundreds of products are entered in the EXCELLENCE AWARDS: THREAT SOLUTIONS categories. Each product is judged by a panel representing a cross-section of SC Magazine readership, which is comprised of large, medium and small enterprises from all major vertical markets including financial services, healthcare, government, retail, education and other sectors. Entrants are narrowed down to a select group of finalists before undergoing a rigorous final judging process to determine the winner in each category.

Quote from Tony Morbin, Editor in Chief, SC Magazine UK

“It’s more important than ever to recognise the tireless efforts of the men and women across the globe who work to combat these threats and provide cyber-security. Sophos’ SG Series UTM is a significant achievement and one that shows Sophos’ dedication to innovation and protecting against the ever-changing threat landscape,” said Tony Morbin, Editor in Chief, SC Magazine.

Defend against APTs with big data security analytics

2015/05/01 by admin

Information Security - February 2015

Without a trace: Cybersecurity incident response teams must follow the thread of security events through volumes of log data from increasingly diverse sources.

Organizations that start to address information security in a meaningful way will come to a point in their maturity when they have a lot of machine data. The challenge many CISOs face is how to leverage that data quickly and correlate events dynamically across the enterprise to track down advanced persistent threats (APTs). The Sony Pictures Entertainment hacking incident in November underscores the importance of security monitoring and rapid incident response to clamp down on damages before disaster strikes.

IT security managers cannot protect what they cannot see, and to “see” associations or patterns that can help detect APTs enterprises must have comprehensive logging in place across multiple layers within a network. The greater the visibility, the larger the machine data, and the harder it is for cybersecurity incident response teams to “follow the thread” and correlate security events with threat intelligence in a meaningful way. The answers to many security questions about fraudulent activity, user behavior, communications, security risk and capacity consumption lie within these large data sets.

Why so much logging? Most advanced adversaries gain access to a victim’s network via malware, drive-by links or Web shells. Once the initial attack phones home — malware will initiate outbound connection to C2 hosts to get around inbound firewall rules — root kits are delivered, and they quickly gain access to a user account and drive around the network as a fully credentialed user. It is difficult to lock down a Microsoft network in any meaningful way without destroying its functionality. A successful strategy to defeat this type of attack includes the following:

Detect the malware or drive-by links before users click on them. To do this a cybersecurity incident response team has to be able to compare user behavior against threat intelligence. This requires full packet logging of all ingress and egress traffic on an enterprise’s edge.
Detect malware or rootkit delivery to the endpoint. To do this the cybersecurity team needs verbose logging on antimalware and endpoint protection systems.
The cybersecurity team needs to be able to analyze user behaviors and access across the entire enterprise. Security information and event management (SIEM) tools can alert you to unusual activity, such as account usage during off hours. This is only possible with comprehensive logging of Active Directory (AD) and host access events.

To read the full article - > Click here

For more information on how to defend against APT, malware or security analytics please contact us.

Employees are weak link in company cyber attacks

2015/05/01 by admin

Mark Burnette, For The Tennessean 11:11 p.m. CDT April 29, 2015

Today’s companies face a truly daunting task when trying to protect their computer systems and sensitive data from compromise. Attackers are better coordinated and more sophisticated than ever before, and their tools are easier to obtain and use.

While there are many security issues for businesses to be concerned about (some of which are covered in other installments of this series), an all-too-common problem at companies of all sizes is attacks directed at the computer users themselves. The vulnerable users are workers in the company who have user accounts and passwords and use desktops, laptops, tablets and other devices to interact with a company’s data and network. Hackers and other bad guys target these users because they have access to sensitive data and systems, their account passwords are typically easy to guess or crack, and they are often willing to open a malicious file, click on an emailed link or even willingly type their password into a bogus site.

Protecting your company against end-user attacks requires a two-pronged approach: 1) train your users to help them be more aware of how end-user security attacks occur and 2) configure your systems to make it harder for the bad guys to successfully get in if a user slips up. Here’s a list of steps you should take:
•Keep up to date with security patches provided by software vendors for end-user machines. In addition to operating system patches, be sure to patch application software such as Adobe, Java and web browsers, as older versions of those tools have well-known vulnerabilities that are frequent vectors of attack.

•Provide spam filtering for every machine, with sensitivity controls turned up. One of the most common tactics attackers use to make initial entry into a company’s network is enticing end users to click on a spam email link that installs malware. While this won’t stop every phishing attempt, if you can filter out even one, that is one fewer opportunity for an unsuspecting user to click a bad link.

•Remove local administrator rights from end-user machines. Local administrator rights give a user more power to make changes to a computer, and if an attacker gains control of a machine with those rights, damage to the network can be much more significant.

•Make sure there is up-to-date anti-virus/malware protection installed on every machine.

•Require IT personnel to use different passwords when they work on servers. Even IT administrators can fall victim to email phishing attacks when they are working on their own computer. If they click on a bad link while logged in as an administrator, attackers can gain big-time access to your network using their privileged credentials.

•Develop a security awareness program for all personnel to help them understand their responsibilities when using a company computer system and/or handling sensitive data. This training should also teach users how to create good passwords (ones that are easy to remember, but difficult to guess).

•And perhaps most importantly, require “two-factor authentication” for users logging on to the network from a remote location. That means that a password alone is not enough to gain access; another form of authentication is needed. That could take the form of such things as a fingerprint, a token (a physical device that generates a code that is entered on the machine) or a digital certificate. If two-factor authentication is in place, an attacker who successfully captures a user’s access credentials still won’t be able to remotely connect to the network without the second factor (the token).

Taking all these measures will not completely eliminate the possibility of a successful attack, but it will greatly reduce your exposure to this common attack path, which just might make a potential attacker move on to a more vulnerable target.
Mark Burnette is a partner in the Security and Risk Services practice at LBMC, the largest regional accounting and financial services family of companies based in Tennessee, with offices in Brentwood, Chattanooga and Knoxville.

Sophos is one of the Leading Vendors for Endpoint Encryption

2015/04/30 by admin

When it comes to security, organizations needs to consider how today’s employees actually work – more and more of the workforce is moving towards mobile – laptops, tablets, smartphones and thumb drives, and most of these devices will eventually hold sensitive data. According to the Forresters Global Security Survey – device loss or theft precipitated 24% of all data breaches.

As such there is a move by to employing encryption on the endpoints, which will not only assist with compliance regulations, but should be considered an essential tool for data protection.

According to the Forrester Wave ^TM, Sophos was deemed the ”breakout star” for Encryption with strong hardware –based encryption support, external media encryption policy flexibility, and file level encryption functionality. In addition a commitment o supporting the MAC OS.

Sophos SafeGuard Enterprise is the complete encryption and data protection solution—from computers to networks, and the cloud.

Sophos uses a single console to manage full-disk encryption, removable-media encryption, file share encryption and cloud –storage encryption. For an evaluation of the product, please click here, or contact us for more information.

HawkEye G 3.0 Released

2015/04/20 by admin

Hexis Cyber Solutions Releases HawkEye G 3.0 with Real-Time Host Event Detection and Integration of Third-Party Security Technologies with Automated Threat Removal

HANOVER, Md., April 20, 2015 –Hexis Cyber Solutions, Inc.(Hexis), a wholly-owned subsidiary of The KEYW Holding Corporation (NASDAQ: KEYW), and a provider of advanced cybersecurity solutions for commercial companies and government agencies, today announced a significant new release of its integrated cybersecurity platform, HawkEye G. New capabilities include ThreatSync™ for evidence-based detection and validation of unknown and known threats, and integration with third-party security technologies such as Palo Alto Networks and FireEye for detection and Splunk for increased threat intelligence.

New Capabilities Provide Accurate Policy-Based Automated Threat Removal
Point security solutions and manual remediation processes cannot adequately address today’s increasingly complex cyber threats. Point solutions lack the features, depth and speed needed to stop the external threat actors as they penetrate the perimeter, install malware, establish persistence and move laterally to reach the target. Furthermore, these point solutions generate large quantities of alerts and false positives, leaving it to the inundated incident responders and security teams to find serious threats hidden in all the alerts – making today’s networks more vulnerable than ever.
“Most industry benchmarks have concluded that the time between exploitation and discovery of malicious activity is measured in weeks, if not months,” said Jon Oltsik, senior principal analyst, Enterprise Strategy Group. “Reducing the time required for detection and removal of cyber threats is the priority for security professionals today. Protecting business critical data, coupled with the overwhelming advanced skills shortage, has created the need for a unified solution that can detect, verify and remove threats at machine speed.”

In a recent report¹ Forrester analysts John Kindervag and Stephanie Balaouras concur stating, “Given the consequences of data breaches, businesses can no longer rely on passive, manual procedures to defend against them. The only way to protect the exfiltration of our data by hackers and cybercriminals is to provide our security teams with a set of rules that will incentivize automated response.”

Working in conjunction with HawkEye G’s policy-based, automated threat removal engine, ThreatSync™ will lower the time between perimeter breach, detection and threat verification, thus empowering security teams to quickly and confidently defend themselves using machine speed removal of sophisticated adversaries.

New Analytics and Third Party Integrations Add More Context Improving Organizations’ Ability to Detect and Remove Threats
Leveraging threat fusion and analytics capabilities from ThreatSync™, and threat intelligence from third-party security solution providers, HawkEye G 3.0 operates as an evidence-based threat removal platform that combats attacks at machine speed. This also enables the security operations teams to more effectively leverage existing security investments as HawkEye G removes the alerts and alarms generated by the third party security products.

Gartner²analyst Lawrence Pingree highlights the importance of “Bringing together system events, network activities and indicators of compromise mapped across a graphical kill-chain timeline and comprehensive analytics capabilities are essential to operationalize and simplify EDR [endpoint detection and response] for security operations personnel.”

HawkEye G 3.0 not only provides its own host-based and network-based detection capabilities, but also integrates with enterprises’ existing security infrastructure by consuming, fusing and verifying third-party alerts. The new ThreatSync™Unified Threat Scoring Model measures threat alerts based on how successfully the adversary is meeting its objectives. If the threat is confirmed to be engaged in malicious activity, the threat score is raised and incident responders can execute automated countermeasures or receive an alert that will allow them to follow machine-guided actions to remove the threat. HawkEye G also integrates transparently into security systems, applications, and processes already in place at organizations, sending threat alerts and response actions to third-party reporting, dashboard and event management systems including Splunk, SIEMs and HawkEye AP.

“The staggering amount of false positives and ghost alerts generated by perimeter-based security devices has left security teams searching for a way to cut through the overwhelming noise,” said Chris Carlson, senior director of Product Management, Hexis Cyber Solutions. “With HawkEye G’s new ability to corroborate actual endpoint behavior captured on the platform’s host detection sensors with third-party data, our continuous monitoring capabilities will help capture, analyze, and remove malicious activity before compromise in the enterprise. This is truly a second generation product, and the customer responses from our initial installations have been extremely positive.”

Availability
HawkEye G 3.0 will be available April 30 through Hexis Cyber Solutions’ network of channel partners.